Refresh reviewed legacy JSON wrapper repair onto current main

.github/workflows/c6-cluster-law.yml

@@ -5,6 +5,9 @@ name: C6 cluster-law checks
     paths:
       - 'frontiers/c6_cluster_law_20260929/**'
       - '.github/workflows/c6-cluster-law.yml'
+      - 'tools/legacy_json_replay.py'
+      - 'tools/legacy_json_contracts.json'
+      - 'tests/test_legacy_json_workflows.py'
   workflow_dispatch:
 
 permissions:
@@ -21,6 +24,13 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Exercise the complete shell rejection contract in both modes
+        env:
+          LEGACY_TEST_FAMILY: 'c6-cluster'
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python -B -S tests/test_legacy_json_workflows.py
+          python -B -O -S tests/test_legacy_json_workflows.py
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -47,24 +57,8 @@ jobs:
               blob = hashlib.sha1(b'blob %d\0' % len(data) + data).hexdigest()
               if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or blob != entry['git_blob']:
                   raise ValueError('consumed source identity mismatch on this tree: ' + entry['path'])
-          script = str(root / 'cluster_law_check.py')
-          expected = (root / 'RESULTS.json').read_bytes()
-          mutants = ['pins-not-critical', 'wrong-pin-hessian', 'drop-sigma-jacobian', 'three-extra-points', 'shear-drop-cubic', 's-bound-constant',
-                     'cross-term-not-small', 'window-closed', 'index-sign']
-          for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script],
-                                   check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in mutants:
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m],
-                                      capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'unknown'],
-                                  capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant not rejected with rc 2')
+          from tools.legacy_json_replay import replay
+          replay('c6-cluster', root)
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

.github/workflows/far-elder-rate.yml

@@ -5,6 +5,9 @@ name: Far elder rate exact controls
     paths:
       - 'frontiers/far_elder_rate_20260930/**'
       - '.github/workflows/far-elder-rate.yml'
+      - 'tools/legacy_json_replay.py'
+      - 'tools/legacy_json_contracts.json'
+      - 'tests/test_legacy_json_workflows.py'
   workflow_dispatch:
 
 permissions:
@@ -21,6 +24,13 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Exercise the complete shell rejection contract in both modes
+        env:
+          LEGACY_TEST_FAMILY: 'far-elder'
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python -B -S tests/test_legacy_json_workflows.py
+          python -B -O -S tests/test_legacy_json_workflows.py
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -42,19 +52,8 @@ jobs:
               framed = b'blob ' + str(len(data)).encode() + b'\0' + data
               if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or hashlib.sha1(framed).hexdigest() != entry['git_blob']:
                   raise ValueError('merged source drifted: ' + entry['path'])
-          script = str(root / 'far_elder_check.py')
-          expected = (root / 'RESULTS.json').read_bytes()
-          for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in ('M1', 'M2', 'M3', 'M4'):
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant label not rejected with exit 2')
+          from tools.legacy_json_replay import replay
+          replay('far-elder', root)
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

.github/workflows/local-pairing.yml

@@ -5,6 +5,9 @@ name: Local pairing exact controls
     paths:
       - 'frontiers/local_pairing_20260930/**'
       - '.github/workflows/local-pairing.yml'
+      - 'tools/legacy_json_replay.py'
+      - 'tools/legacy_json_contracts.json'
+      - 'tests/test_legacy_json_workflows.py'
   workflow_dispatch:
 
 permissions:
@@ -21,6 +24,13 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.11.16'
+      - name: Exercise the complete shell rejection contract in both modes
+        env:
+          LEGACY_TEST_FAMILY: 'local-pairing'
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python -B -S tests/test_legacy_json_workflows.py
+          python -B -O -S tests/test_legacy_json_workflows.py
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -55,19 +65,8 @@ jobs:
               framed = b'blob ' + str(len(data)).encode() + b'\0' + data
               if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or hashlib.sha1(framed).hexdigest() != entry['git_blob']:
                   raise ValueError('merged source drifted: ' + entry['path'])
-          script = str(root / 'pairing_check.py')
-          expected = (root / 'RESULTS.json').read_bytes()
-          for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in ('M1', 'M2', 'M3', 'M4'):
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant label not rejected with exit 2')
+          from tools.legacy_json_replay import replay
+          replay('local-pairing', root)
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

reviews/legacy_json_workflow_repair_20261006/SCOPE.md

@@ -0,0 +1,123 @@
+# Three legacy JSON wrappers: authenticate the intended rejection
+
+Dylan Roy — delegated AI engineering. Actual author OpenAI / GPT-6 Astra Pro,
+`legacy-json-repair-continuity-20261006-r8`, pickup Math-#322/6008335661.
+Scientific effect NONE; shared-account/provider organizational credit0.
+Author-side implementation; separate engineering review and eligible integration
+are required. No mathematical acceptance or source-proof correction is asserted.
+
+## Finding and exact source
+
+This repairs AUD-LEGACY-MUTANT-01, recorded in #322. The complete genuine-CLI
+characterization and two additional full-shell falsifications were delivered by
+another session in #322/6008323186; this implementation credits those results.
+Source cut for the unchanged contracts: b25cac0bcbb4032d624f14795257d9578c90d105.
+Integration base: 4a7a5b771e248123f601578b7d237af924d023a4. Native comparison shows
+only unrelated #324/#321 additions between these cuts, not a changed source here.
+
+| Original workflow | Git blob |
+|---|---|
+| local-pairing.yml | 30feada3a0c5c771f938b592e23ab0f262264ae8 |
+| far-elder-rate.yml | 7be1fdeea1eb13ea6b794b33190971a6081ecc56 |
+| c6-cluster-law.yml | 85bbd08ea908d28ffb6eda940f63db3ba1b1a4bb |
+
+All three admitted any exit1 as an intended mutant rejection and ignored baseline
+stderr. An unrelated crash or silent exit could therefore pass. Unknown-label
+controls checked exit2 alone. The scientific CLI sources themselves were not
+reported to crash, and no theorem is refuted by a wrapper defect.
+
+## Repair and preservation
+
+Seven engineering files: the three workflows, tools/legacy_json_replay.py,
+tools/legacy_json_contracts.json, tests/test_legacy_json_workflows.py, and this note.
+The original scientific source-validation block before child execution and final
+tracked Git-diff guard are unchanged. Checker, proof, RESULTS, manifest and source
+map files are untouched. Existing action/Python pins, read-only permission,
+persist-credentials:false, 10/10/15-minute job budgets and 600-second child budget
+remain. Each workflow now triggers on the new helper/reference/test paths and
+executes its applicable family of whole-shell regressions in both Python modes.
+No #321 helper or #320/#312 source is edited.
+
+The reference data stores independently measured COMPLETE reports and exact
+checker/RESULTS identities. Expected values are never learned from the invocation
+under test. Successful baseline: exit0, empty stderr, byte-identical RESULTS.
+Mutant: exit1, empty stderr, a single UTF-8 JSON object with the exact recursive
+keys/types/values/list order and full information/reason. Duplicate keys, floats,
+nonfinite constants, type-confused booleans, missing/extra data or trailing JSON
+reject. Harmless JSON whitespace/key order/indentation is permitted for mutants,
+not for the frozen successful baseline. Source/reference drift needs a new read.
+
+Local M3 and M4 each fail TWO checks. Local M1/M2 share a false check but have
+different info; neither an exactly-one-false rule nor a failed-name-only predicate
+would be correct. C6's failures are exactly error+passed objects from a caught
+ValueError; no uncaught-assertion adapter is introduced.
+
+Local/far invalid labels require exit2, empty stdout and the exact 21-byte message.
+C6's full argparse diagnostic is constructed by the PARENT from its frozen
+argument grammar, fixed choice order and script basename, using the same Python
+interpreter as the child. This accounts for usage wrapping without learning the
+expected message from child output or assuming local Python3.13 equals hosted3.11.
+Every run emits command-outcome stream lengths/hashes; mismatches, TimeoutExpired
+and OSError fail instead of becoming intended-control receipts. No sandbox,
+malicious-source defense, complete process-evidence recovery or global source
+admission property is claimed. Authenticated source and reviewed reference data
+are the trust boundary; legitimate reference changes still require review.
+
+## Execution and non-vacuous regressions
+
+Actual local CPython3.13.5; standard library only. The three original scientific
+CLIs and RESULTS matched native Git blobs before 46 authentic baseline/mutant/
+unknown-label invocations. All 23 normal/optimized stdout AND stderr pairs match.
+All three repaired helper invocations then re-executed their complete authentic
+inventories successfully (46 further child executions, not new control types).
+
+The 12-method regression suite executes real complete workflow verification
+shells in committed temporary SYNTHETIC Git repositories: nonempty source pins,
+full hash/size guards, both child modes, every original label and final Git diff.
+Only synthetic source identity is rebound; the expected output data stays fixed.
+No subprocess is mocked. Traces verify the targeted child was reached and stop
+at rejection. Source/pin tampering rejects before any child executes.
+
+Per outer Python mode: 57 local, 57 far and 87 cluster shell fixtures, 201 total.
+The final candidate passed both outer modes: 402 fixtures. These are 12 distinct
+methods with family selection, not 72 distinct tests. Against the exact ORIGINAL
+workflows, the same suite in normal outer mode produced 48/48/78 false-acceptance
+failures, 174 total, with NO test errors; the other 27 cases retained their intended
+outcomes. Both target child modes occur in each outer run. Original outer -O was
+not separately replayed or claimed. Earlier interrupted partial runs are retained
+but excluded from completed-run totals.
+
+Coverage includes every mutant stage with unrelated crash, silence and wrong
+reason; malformed/type-confused/duplicate/trailing JSON; baseline stderr; wrong
+unknown diagnostics/stdout; wrong exits; source tampering; and accepted harmless
+mutant formatting. The reference-data canonical digest and frozen baseline hashes
+are also checked. The suite does not assert a mathematical interpretation of every
+reported info value: it verifies exact retention of the existing source contract.
+
+From repository root:
+
+    python -B -S tests/test_legacy_json_workflows.py
+    python -B -O -S tests/test_legacy_json_workflows.py
+
+LEGACY_TEST_FAMILY selects local-pairing, far-elder or c6-cluster, as the dedicated
+workflows do. LEGACY_SOURCE_ROOT is test-only and selects the predecessor workflow
+for falsification; neither variable changes production helper behavior.
+
+## Custody and release limits
+
+Local direct GitHub access fails DNS; execution used authenticated exact-source
+subsets recovered from archives/native reads. All 29 unique quoted upstream
+sources (34 rows across the three manifests) were recovered by exact identity.
+The recovered local-pairing full packet manifest is an older snapshot, so this
+session does NOT claim a full contemporary original-packet source-guard replay.
+Actual scientific scripts/RESULTS are current and exact; synthetic whole-shell
+source guards and direct genuine helper execution are separate evidence. Hosted
+candidate workflows must exercise the actual full checkout and pinned3.11.16.
+
+Current-candidate dedicated workflows plus the required general aggregate must
+pass, followed by a source-bound nonauthor engineering read and separate eligible
+integration. No old test/CI receipt is rebound after a source change. #322 remains
+open until its real repair/integration predicates are fulfilled; this does not
+clear the remaining legacy wrappers, scientific qualifications, C6 retractions,
+independent formal alignment or other research obligations. Offline delivery is
+a new supplement, not alteration of sealed prior archives or proof of a Mac save.